Conditional Access & Threat Defense

These features are built into the AIC CMMC Completeâ„¢ Level 1, Level 2, and Level 3 kits. In industry terms they cover conditional access, Identity Threat Detection and Response (ITDR), and Identity Security Posture Management (ISPM) for the kit's own sign-in surface.

Short Answers

What is conditional access in the kit?

A set of rules that allow, step up, or deny a sign-in. Rules use the source country, the network address, threat intelligence lists, and the sign-in policy.

Can I block countries?

Yes. Each country is allowed, conditional (extra verification preferred), or blocked. A defense contractor preset allows the United States and Five Eyes partners, marks close partners as conditional, and blocks a high-risk set.

Does the kit use threat intelligence?

Yes. Feeds from FireHOL, ET Open, and AbuseIPDB lists can deny sign-in from known-bad addresses. Feeds load from a file on air-gapped systems. Entries can be suppressed without deleting them.

What does the threat report show?

Denied and failed sign-ins, unique sources, attack origin by country, the MITRE ATT&CK techniques they map to, top source addresses, and the most-tried usernames. Each count opens the log that produced it.

Is every sign-in logged?

Yes. The logon audit is append-only. It records time, username, outcome, source address, and reason. Passwords and session tokens are never stored.

Conditional Access Controls

Control	What It Does
Country access policy	Allow, conditional, or deny sign-in by source country, with a world map and pick lists
Network access control list	Ordered allow and deny rules by IPv4 or IPv6 range or host name, first match wins
Threat intelligence deny	Deny sign-in from addresses on loaded feeds, with fail-open or fail-closed choice
Multifactor authentication	Time-based one-time codes and passkeys (WebAuthn), with RADIUS as a second factor
Password policy and lockout	Length, age, history, complexity, and lockout after failed attempts
Session timeouts	Idle and absolute limits, token rotation, forced logoff
Identity providers	Local accounts, OpenID Connect, Windows Integrated, and Active Directory
SAML 2.0 federation	Security Assertion Markup Language (SAML) 2.0 identity providers
Classification gate	Mandatory access control can require a minimum clearance to sign in

Screenshots

The failed sign-ins in the threat report were made for this demonstration against accounts that do not exist.

Attack / Threat Report for the last 7 days showing 8 denied and failed sign-ins, 1 unique source, 1 mapped MITRE ATT&CK technique, and an attack origin map. — The Attack / Threat Report counts blocked and failed attempts and maps them to MITRE ATT&CK.

Threat report detail showing attack origins by country, MITRE ATT&CK coverage with technique T1110 Brute Force under Credential Access, and attack volume by top source address and most-tried usernames. — Failed sign-ins are mapped to MITRE ATT&CK technique T1110 Brute Force, with top sources and most-tried usernames.

Logon audit table of append-only sign-in events with time, username, outcome, source address, and reason, showing successful sign-ins and failed attempts for nonexistent accounts. — Every sign-in attempt is logged append-only, with outcome, source, and reason, and exports to CSV or JSON.

Country access policy with allowed, conditional travel, and blocked country lists, a defense contractor preset, and a world map colored green for allow, orange for conditional step-up, and red for deny. — Conditional access by country: allow, require extra verification, or deny sign-in by source country.

Network access control list of ordered allow and deny rules by IPv4 CIDR range, first match wins, with notes and a test tool. — Ordered network rules allow or deny sign-in by address range before any password check.

Threat intelligence feeds from FireHOL, ET Open, and AbuseIPDB with version and entry counts, a feed entry browser with suppress, edit, and remove actions, and air-gapped feed import. — Threat intelligence feeds block known-bad addresses at sign-in, and load offline on air-gapped systems.

Logon policies for multifactor authentication with time-based one-time codes, local password policy with length, age, history, and complexity, and passkey (WebAuthn) settings. — Sign-in policy covers multifactor authentication, passkeys, password rules, and lockout.

Session Timeout And Logoff settings with absolute lifetime, idle timeout, token rotation on refresh, HttpOnly cookies, and forced logoff on expiry, mapped to NIST SP 800-53 AC-12 and SC-23. — Session timeouts and forced logoff limit the risk of an unattended or stolen session.

Identity provider list with local accounts, OpenID Connect directories, Windows Integrated Kerberos sign-on, and on-premises Active Directory LDAP bind, with status and enable controls. — Sign in with local accounts, OpenID Connect, Windows Integrated, or Active Directory.

Related Controls

Framework	Controls
NIST SP 800-53	AC-2, AC-7, AC-12, AC-17, IA-2, IA-5, SC-7, SC-23, SI-4, AU-2, AU-6
NIST SP 800-171	3.1.1, 3.1.8, 3.1.11, 3.1.12, 3.5.3, 3.13.1, 3.14.6
CMMC	AC.L2-3.1.8, AC.L2-3.1.12, IA.L2-3.5.3, SC.L1-b.1.x, SI.L2-3.14.6
ISO/IEC 27001	Annex A 5.15, 5.17, 8.5, 8.16, 8.20

An assessment organization, certification body, or regulator decides whether a requirement is satisfied.